影響を受けるバージョン系列
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-101056 | Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint | < 4.16.1 | 6.9 | — | 2026-09-28 | |
| CVE-2026-101051 | Cloudreve before 4.16.1 Path Traversal via Remote Download | < 4.16.1 | 2.3 | — | 2026-09-28 | |
| CVE-2026-101048 | Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope | < 4.17.0 | 5.3 | — | 2026-09-28 | |
| CVE-2026-77637 | Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope | * | 3.8 | — | 2026-09-23 | |
| CVE-2026-77633 | Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service | * | 7.1 | — | 2026-09-23 | |
| CVE-2026-79913 | Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4)... | * | 6.5 | — | 2026-09-23 | |
| CVE-2026-62323 | Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored | * | 6.3 | — | 2026-07-31 | |
| CVE-2026-55502 | Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials | * | 7.1 | — | 2026-07-31 | |
| CVE-2026-55499 | Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-fi... | * | 4.3 | — | 2026-07-31 | |
| CVE-2026-55497 | Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) | * | 6.5 | — | 2026-07-31 | |
| CVE-2026-55496 | Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the... | = 4.17.0 | 4.3 | — | 2026-07-31 | |
| CVE-2026-55495 | Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account | * | 4.3 | — | 2026-07-31 | |
| CVE-2026-54560 | Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim | * | 7.6 | — | 2026-07-15 | |
| CVE-2026-54563 | Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes... | * | 7.1 | — | 2026-07-15 | |
| CVE-2026-54562 | Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses | * | 6.5 | — | 2026-07-15 | |
| CVE-2026-25726 | Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) | * | 8.1 | — | 2026-04-04 | |
| CVE-2022-32167 | Cloudreve - Stored XSS | ≥ 3.0.0-beta < unspecified ≥ unspecified ≤ 3.5.3 | 5.4 | — | 2022-09-20 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。